Atomic Edge analysis of CVE-2026-65546 (metadata-based): This vulnerability is an unauthenticated SQL Injection in the Qode Tours WordPress plugin, affecting versions up to and including 3.1.3.1. The plugin fails to properly escape a user-supplied parameter and lacks sufficient query preparation, allowing attackers to inject arbitrary SQL into existing database queries. With a CVSS score of 7.5 and a CWE-89 classification, the attack can be performed remotely without authentication, compromising the confidentiality of the database.
Root Cause: Based on the CWE-89 classification and the vulnerability description, the root cause is an improperly sanitized parameter used directly in a SQL query built by the plugin, likely through a WordPress $wpdb method (e.g., $wpdb->query(), $wpdb->get_var(), or $wpdb->get_results()). The description confirms insufficient escaping of a user-supplied parameter and lack of prepared statements. Atomic Edge analysis infers that the vulnerable parameter originates from a plugin-specific endpoint, such as an AJAX action or a shortcode, where user input is concatenated into a SQL statement without using $wpdb->prepare(). This conclusion is inferred from the CWE and the description, as no source code or patch diff is available for direct verification.
Exploitation: An unauthenticated attacker can send crafted HTTP requests to the plugin’s exposed endpoints, likely an AJAX action under /wp-admin/admin-ajax.php or a REST API route, with the vulnerable parameter containing SQL injection payloads. Since the plugin uses the slug ‘qode-tours’, plausible AJAX action names include ‘qode_tours_search’ or similar, but the exact endpoint is not confirmed from the metadata. The attacker would use classic SQL injection techniques, such as UNION-based payloads or time-based blind payloads, to extract data like usernames and password hashes from the WordPress database. The attack does not require any authentication or nonce, making it trivially exploitable.
Remediation: The fix requires implementing proper parameterized queries using $wpdb->prepare() or moving to prepared statements with placeholders. The plugin must escape user-supplied parameters before they reach any SQL statement, and validate the input against expected formats (e.g., integers or allows lists). Additionally, the plugin should enforce nonce verification on all form submissions and AJAX requests to prevent CSRF-based injection attempts. Until a patched version is available, site administrators should disable the plugin or restrict access to any endpoints that handle unauthenticated database queries.
Impact: Successful exploitation allows an unauthenticated attacker to extract sensitive information from the WordPress database, including user credentials, password hashes, session tokens, and other plugin-specific data. The CVSS vector indicates high confidentiality impact with no integrity or availability impact, meaning the primary risk is data exfiltration. In severe cases, extracted hashes could be cracked offline, leading to account takeover. There is no direct privilege escalation, but the exposed data could facilitate further attacks on the site.
